Malicious code in supplyhub (npm)
The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook (postinstall: node postinstall.js) that executes automatically on npm install, before the package is ever imported.
postinstall.js uses fs.readFileSync to read the user's SSH private key (~/.ssh/id_rsa) and the process environment (/proc/self/environ — where CI/cloud tokens and npm tokens live), and gathers account/host identity via os.userInfo(); it also references /etc/passwd. The collected data is exfiltrated by HTTP POST to a hard-coded webhook.site dead-drop: https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3.
Only version 1.0.2 is malicious: version 1.0.0 (held in the codelake corpus) is clean — the exfiltration code was introduced in the 1.0.2 release (a trust-then-poison pattern). Any workstation or CI runner that installs [email protected] (directly or transitively) hands its SSH key and environment secrets to the operator. Detected and classified independently by codelake Research from the live npm feed on 2026-07-20; not present in OSV or GHSA at the time of reporting (a first-catch).
Source: amazon-inspector
[email protected] ships a postinstall.js that runs automatically on npm install and collects installer host identifiers (os.hostname(), os.userInfo().username, process.cwd(), pid, platform, arch, node version) along with CI-related environment variables (CI, RENOVATE_VERSION), then transmits them as query parameters to a hardcoded webhook.site endpoint (https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3) using https.get with http and execSync('curl...' || wget...) fallbacks. The package.json description self-labels this as a dependency-confusion PoC targeting the 'Travix supplyhub' name, but the tarball is published to public npm and will execute the install-time beacon against any installer that resolves this name, including unrelated users who typo or whose internal builds dependency-confuse into it.
